fix: proxy embed to A public host with correct Host/SNI [deploy]

docker-entrypoint.d/40-a-upstream.sh

@@ -2,9 +2,16 @@
 set -eu
 
 CONF=/etc/nginx/conf.d/default.conf
-A_UPSTREAM="${A_UPSTREAM:-http://project57-deploy.ns-project57.svc.cluster.local:3000}"
+# A 站已有公网域名时走公网更稳；也可设为集群内 http://service.ns.svc:port
+A_UPSTREAM="${A_UPSTREAM:-https://project57.website-build.org}"
 A_UPSTREAM="${A_UPSTREAM%/}"
 
+# 从 URL 提取 Host，供反代 Host / SNI（Cloudflare/Ingress 依赖正确 Host）
+A_HOST="$(printf '%s' "${A_UPSTREAM}" | sed -E 's|^[a-zA-Z][a-zA-Z0-9+.-]*://||; s|[:/].*$||')"
+if [ -z "${A_HOST}" ]; then
+  A_HOST=project57.website-build.org
+fi
+
 NS="$(awk '/^nameserver/{print $2; exit}' /etc/resolv.conf || true)"
 if [ -z "${NS}" ]; then
   NS=kube-dns.kube-system.svc.cluster.local
@@ -13,6 +20,8 @@ fi
 sed -i \
   -e "s|__RESOLVER__|${NS}|g" \
   -e "s|__A_UPSTREAM__|${A_UPSTREAM}|g" \
+  -e "s|__A_HOST__|${A_HOST}|g" \
   "${CONF}"
 
+echo "nginx upstream: ${A_UPSTREAM} (Host ${A_HOST}, resolver ${NS})"
 nginx -t